1-0 Serge Leef

Convergence of silicon, Sensors,
Mobility, and Cloud as Driving

Forces in System Design Evolution
Serge Leef
VP, New Ventures, Mentor Graphics
April 21, 2016, Monterey, CA
Outline
Driving forces behind IoT
Metamorphosis of embedded systems
Domain driven end-to-end applications
IOT Enablement tools and technologies
Security implications of a large attack surface

Mentor Graphics Corp. Company Confidential
www.mentor.com
EDPS 2016 Keynote - S. Leef - April 2016
IoT: Emergence of Intelligent Systems
Intelligent Systems / Internet of Things
75B Devices will be connected by 2020 (Morgan Stanley)
Execute native or cloud-based applications
Data collection & analytics
Explosive growth potential
Internet of Things
Uniquely identified things
Machine-to-machine communication
Cloud infrastructure
Cyber-physical systems
Edge-node design
Electronics, Controls, Software
Multi-physics, Communications
* Rethinking the Internet of Things: A Scalable Approach to Connecting Everything, Francis daCosta
2010 Mentor Graphics Corp. Company Confidential
EDPS 2016 Keynote - S. Leef - April 2016 www.mentor.com
DRIVING FORCES BEHIND IOT

www.mentor.com
Growth in processor complexity & size
Complex communication fabric

Complex, layered software 2005
1.72B
Transistors
Data & protocol engines 2004
592M
Dual Core Itanium
Re-used design blocks 2002

Transistors
Itanium 2 (9MB cache)
220M
Multiple processors 2000
Transistors
Itanium 2
42M
Large memories 1999

9.5M+
Transistors
Pentium 4
Transistors
Pentium III
1997
7.5m+
Transistors
1995 Pentium II
5.5M+
Transistors
1993 Pentium Pro
3.1M+
Transistors
Pentium
1989
1,290,000
Transistors
1985 486
275,000
Transistors
1982 386
1979 134,000
29,000 Transistors
Transistors 286
8088

What happened since 2005?
2005 2014
180nm 90nm 60nm 18nm
3G/4G/LTE
Bluetooth
Wi-Fi
Encryption
Compression
Navigation
Speech Processing
Audio/Video
Motion Detection
Voice Telephony
Internet Access
Gaming
Search
We are running out of ideas on what else to put on the chip,

so we are staying at ~20M gates for now
a cell phone company executive in 2005
Since 2005 we found many more features that are needed

Silicon technology enabled shift of
SW
innovation to software & connected systems SW
SW
Multiple Billions SW
of Transistors
Integrated and
Connected Systems
Multiprocessing
Gigabit,
Non-volatile
Memory
Digital Signal
Processing
Microprocessor
Packaged IC
Consumer
Communications Energy
SW Medical
Desktop 42M SW Industrial
Computer Transistors Automotive
Military & SW Aerospace
Aerospace 1,290,000
Transistors
29,000
Transistors Pentium 4
SW
SW SW
486
8088
1970 1980 1990 2000 2010 2020

Meanwhile cost of sensors has declined

EDPS 2016 Keynote - S. Leef - April 2016 Source: http://uk.businessinsider.com/internet-of-everything-2015-bi-2014-12?op=1 www.mentor.com
And internet connectivity exploded
Source: http://uk.businessinsider.com/internet-of-everything-2015-bi-2014-12?op=1

EDPS 2016 Keynote - S. Leef - April 2016Source: http://uk.businessinsider.com/internet-of-everything-2015-bi-2014-12?op=1 www.mentor.com
EDPS 2016 Keynote - S. Leef - April 2016Source: http://uk.businessinsider.com/internet-of-everything-2015-bi-2014-12?op=1 www.mentor.com
14 EDPS 2016 Keynote - S. Leef - April 2016 Source: http://uk.businessinsider.com/internet-of-everything-2015-bi-2014-12?op=1 www.mentor.com
METAMORPHOSIS OF
EMBEDDED SYSTEMS

www.mentor.com
What is IoT?
Internet connected general purpose computers
Internet of Things connects everyday objects to Internet
Everyday objects have to be re-designed to include computers

Standalone TV becomes a Smart TV by connecting to Internet and offering on-
demand content, shopping, browsing, e-commerce
Standalone Garage Door Opener becomes smart by connecting to your smart

phone over Internet

Transformation of Embedded Systems into IoT world
Set-top Box Smart Phone Garage Opener
(2000) (2010) (2013)
Application App
App
Mobile
Definition of embedded system is

App
App
Content
App
App
garage
control
access App App
App app
UI App
App
App
App
App
Private interface
changing, its morphing into a
App
Internet
connected IoT end node
Middleware
Linux API MobileOS API Private interface
Remote Large
Mobile conduit
Linux
OS Attack Surface
Private interface
HAL HAL
Internet
Hardware
WiFi
Memory Memory
CPU
Application
Processor
CPU
Sensors
Baseband
Processor
Ethernet
Actuators
Radio / WiFi

www.mentor.com
Next Generation:
Objects interact without human facilitation

Next-Next Generation?

Internet of Things:
Computing in 2015 - 2020
Humans are still part of the picture

20 EDPS 2016 Keynote - S. Leef - April 2016 *Image uses elements from Intel Corp web site www.mentor.com
DOMAIN DRIVEN
END-TO-END APPLICATIONS

www.mentor.com
IoT Projected Market Size Generates Excitement
INTERNET OF THINGS
Cisco
$14.4 Trillion
IDC
$8.9 Trillion
$300 Billion
to Machina Research
$4.5 Trillion
$14.4 Trillion
Gartner Research
Infosys* $1.9 Trillion
$300 Billion
*By 2017

HYPE IN 2015 AROUND THE INTERNET OF THINGS (IOT)
Source: Gartner (August 2014)
But
IoT is not a singular
homogeneous thing
Its an enabler for
numerous vertical
applications
Where
Domain expertise
meets
Mobility, Sensors
Limitless storage
Infinite compute power
Pervasive internet access
IoT Health Care Application

IoT Agribusiness: Connected Cows

IoT Smart Garden: Lawn Sprinklers

IOT ENABLEMENT TOOLS
AND TECHNOLOGIES

www.mentor.com
How can EDA enable the IoT system developers?
Technology Platform End-to-End, Customizable IoT platform
Hardware: Customizable Gateway/Aggregator
Software
Automated and Scalable Cloud-Hosted Backend (Central Node)
Cloud connectivity middleware, device management, cloud services
OS and tools for Secure Converged Gateway software
Embedded software for edge devices
Platform as a Service Managed IoT Platform

Managed complete technology solution that includes the Central Node,
Gateways and/or customers devices
Solution as a Service Turnkey End-to-End Managed Solution

Architect, implement, integrate, run, and support vertical solutions
www.mentor.com
Managed Server On
Edge of the Cloud
Memory, Storage
Local Compute,
Connectivity
XMPP, HTTPS
SCALABLE BACKEND
WIRELESS DEVICE
Sensors
Local Compute
Connectivity
Actuators
GATEWAY
WIRED DEVICES WIRELESS DEVICES
USB, Ethernet & SENSOR NODES
WiFi, BLE
MQTT
TV/DISPLAY
HDMI, LVDS
ADMIN SOLUTION CLOUD ON-PREMISE DEVICE

CLIENTS CLIENTS (APPS) SERVICES SERVICES (FOG) SERVICES (MIST)

29 EDPS 2016 Keynote - S. Leef - April 2016 www.mentor.com
Gateway is a High-Performance Computer, Managed Remotely
From a Cloud-Hosted Backend
Wireless Gateway
Networking Switch 802.11ac & BLE
Optional On-Premise
802.15.4 Server - On the
(ZigBee/6LowPAN) Edge of the Cloud
Freescale i.MX 6 Quad Cortex A9 processor

Wired Gateway 2G DDR3 Memory Set-top Box
16G eMMC
HDMI Output for Accelerated Video
WiFi (802.11b/g/n) and Bluetooth Low-Energy
2 X Gigabit Ethernet Connectivity
4 X USB Ports
1 X USB OTG (internal)
Full-Size SD CARD Slot
NGFF (M.2) Slot for SSD
2 X UARTs (internal)
10 X GPIO Lines (internal)
Dimensions 129mm (L) * 89.6mm (W)

M2M and IoT Cloud Platform
M2M IoT
Managed REST Services APIs MANAGED DEVICE SERVICES

Device provisioning
Managed Solutions M2M Applications Web Applications IoT Applications Device monitoring
Utilization monitoring
Event logging
Managed REST Services APIs
Device and Remote device control
Data Services Managed RESTful RESTful Admin Remote firmware updates
Managed RESTful
Device Services Services APIs
Data Services APIs Remote driver updates
APIs and Admin Portals
Remote feature unlocking
Server Templates & Recipes from RightScale Analytics & Big Data
Managed & Scalable
IT Infrastructure Server Provisioning Server Scaling & Server Monitoring
Server Lifecycle High Availability & Analytics
Cloud Vendor APIs

Vendor-Independent
Cloud Infrastructure Private Clouds,
Amazon Web Google Cloud
Additional Public
Services Services
Clouds

Example vertical applications
Smart Lobby Managed Climate Control

www.mentor.com
SECURITY IMPLICATIONS OF A
LARGE ATTACK SURFACE

www.mentor.com
Race to bare metal cyber attacks move lower in the stack
and IoT egde nodes are soft targets
ATTACK TYPES RELATIVE IMPACT
Social Engineering User 1 - 100

(Phishing/bating)
Malware / Macros Application 10,000 100,000

(Information harvesting)
Viruses/ Trojans Operating System ~100 Million

(Hijacking, DDoS, etc)
Counterfeiting/Trojans Hardware
IoT ~50 Billion
~2 Billion

IoT World is Already Under Attack

Hack Your Audi S4
And Get the Horse Power and Torque of an RS4

Source: Chris Harris Proves the Power of ECU Tweaks with Audi S4 vs RAS4 Comparative Test, Carscoop, April 4, 2013
www.mentor.com
Syrian Radar Case
September 2007, Israeli jets bombed a suspected nuclear installation in northeastern
Syria. Among the many mysteries still surrounding that strike was the failure of Syrian
radar, supposedly state of the art, to warn the Syrian military of the incoming assault. It
wasnt long before military and technology bloggers concluded that this was an incident
of electronic warfare and not just any kind. Post after post speculated that the
commercial off-the-shelf microprocessors in the Syrian radar might have been purposely
fabricated with a hidden backdoor inside. By sending a preprogrammed code to those
chips, an unknown antagonist had disrupted the chips function and temporarily blocked
the radar
Source : IEEE spectrum, 2007

Stuxnet Virus - Delivered by Infected USB Flash Drive
Stuxnet, a 500-kilobyte computer worm that infected

the software of at least 14 industrial sites in Iran
IEEE, The Real Story of Stuxnet, February 26, 2013

The Candy Drop
Security firm hired to test
data security of credit union
Scattered 20 infected USB flash drives
in parking lot, picnic and smoking areas
15 were plugged into company computers
Passwords, logins and other information were compromised
U.S. Department of Homeland Security Test

USB flash drives scattered in government parking lots
60% of those found were plugged into networked computers
90% of those with official logos were plugged in
Source: Information Week, June 7, 2006 & Business Insider, July 24th 2013

Hardware Attack Types
Side-Channel Attacks - (SECRET EXTRACTION)
Malicious Logic inside Chip - (TROJANS)
Counterfeit Chips - (SUPPLY CHAIN ATTACKS)

Side-Channel Attacks
To crack safes, its essential to know how they work

DPA: Differential Power Analysis
Thermal images can help in locating cryptographic circuits
Attempts to enter candidate keys should exercise crypto
This results in visible power dissipation
Subsequently, different power dissipation patterns can be observed

based on correct or incorrect key entry attempts
Keys can then be inferred
Countermeasures for Side-Channel Attacks
Incorporate randomness into

cryptography
Use fixed-time algorithms to

reduce data-related timing
signatures
Camouflaging structures from

reverse engineering

Hardware Trojans
Rogue hardware injected into the design/chip

Untrusted IP cores (design phase)
Untrusted fab (fab phase)
Triggered subsequently
Special date/time
Receipt of special signal
Payload = Malicious Action

Types of Attacks
Kill switch: Breaking the system
Backdoor: Gaining access to the system. e.g., sending
confidential data off-chip
The Hacker in Your Hardware, Villasenor, Sci. American 2010

Easiest entry point: 3rd party IP
Attacking IC Design Flow
Requirements
Design Specification
RTL Coding
3rd Party IP
and Code Reuse
Functional Verification
Logic Synthesis
Complicated
3rd Party Scripts
Gate Level Simulation
Place & Route

Physical IP
Layout Verification

Countermeasures: Run-time Detection?
Co-processor for run-time Trojan detection
Include co-processor in the design as an IP block
Issues targeted
Peripherals with hidden functionality
Prevention of undeclared communications
UART
CPU Memory Input / Output
Control Bus
System
IP blocks verified for functionality
Bus
A key question NOT asked is: Address Bus
Does this block do Data Bus
UART
anything ELSE?
Cybersecurity
Co-processor

Counterfeit and recycled chips

Lifecycle for a Single IC
JSF (Joint Strike Fighter) Case Study
Global nature of supply chain makes chain-of-custody unworkable
Semi Manufacturing & Printed Circuit Printed Circuit

Semi Design Board Distribution
Packaging Board Production
Component changes hands 15 times before final install

48 EDPS 2016 Keynote - S. Leef - April 2016 Source: IDC Manufacturing Insights & Booz Allen analysis www.mentor.com
Creating Secure Silicon in an
Untrusted Environment VPN for Silicon
Untrusted
Data Secure Tunnel (VPN) Users
Network
VPN for
Trusted Silicon
Untrusted
IC Supply Chain Protection Solution Users

Design
Supply Chain

Supply Chain Enablement
IC Supplier Foundry OSAT System OEM Distributors
Engineering Wafer Test Package Test System Design Field Use
SoC RTL
DFS DFS DFS DFS
DFS Gen
DFT
(IJTAG Std.)
Physical
ATPG
JTAG Connectivity Other I/F Connectivity
Operations
D Enrollment Categorization Provisioning Validation
Server F
DB S
*Schuttle or Volume
Tape-out Production* AUTHENTICATION-enabled Applications
Per Design $ Per Part $ Per Transaction $
www.mentor.com
Security Subsystem
IP1
Connectivity Interface
Other middleman between SoC & Server
JTAG
CPU I/F
Disabled Bridge Interface Selector

JTAG (Up to OEM), Other (Field)
Config. Registers IP2
Decoder
Holds decoded values that
enable/disable IPs or lock
Authentication Hardware
Memory Validates fingerprint in response to
portions of internal logic.
server providing a unique FP-Code
These are unique per Chip.
DFS Protocol
IP3 Odometers
Holds Part Usage Info
Security Block Fingerprint ID
Depending upon user- CPU Config Code
driven configuration Other Codes Maintains Public Data
and end application Enabled OTP Memory Data is decoded to authenticate
the SoC or provision its features

www.mentor.com
Protecting Design and Managing IC Lifecycle
Provision IC to obfuscate key design IP inside
Can be achieved by inserting encryption logic in areas to be protected
Added area (cost) may not be prohibitive (i.e. 5% for 250M gate design)
Strong obfuscation makes it difficult to reverse engineer the IC
Potential solution to mitigate for loss of trusted foundry
obfuscated
SOC secret
secret
block
block
commodity IP
(not to scale)
Provision Odometers to manage IC lifecycle

Measure usage or status for each IC relative to the stage in its lifecycle
Limit usage or disable IC if not connected to server often for a refresh
Potential to enable new SaaS (Silicon as a Service) business model
Manage IC lifecycle and obsolesce relative to the application and usage

www.mentor.com
Managed SoC Lifecycle Can Drive
Opportunities for Big Data Analytics
IC Supplier Foundry OSAT System OEM EMS Vendor Distributor
Test Pattern Test Pattern App Config OEM IDs Distributor ID
Design Design ID Test Config Debug Config Device BOM Meter Config
Config # of Parts (Gas Tank)
Big Data Analytics Enrollment Binning Provisioning Authorization Field Use
Wafer Info Serial No App Info OEM Info Distr Info

Field Chip Data SKU Info Debug Info Device Info Chip Info
Info Activity Logs Activity Logs Activity Logs Activity Logs Activity Logs
BIG
DATA
On Premises or Cloud Server

+
Wafer Lot
+
Package ID
+
App Data
+
Device ID
Wafer Map SKU Config Debug Data Dev Config
Chip ID Wafer Lot Package ID Device ID
App Data Usage Data
& DNAs
Wafer Map SKU Config Debug Data Dev Config Chip Status

www.mentor.com
EDA Will Be the Focal Point of the
Countermeasure Strategies

www.mentor.com
w w w. m e n t o r. c o m

www.mentor.com

1-0 Serge Leef

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1-0 Serge Leef

Uploaded by

Copyright:

Available Formats

Convergence of silicon, Sensors,

Mobility, and Cloud as Driving

Driving forces behind IoT

Metamorphosis of embedded systems

Domain driven end-to-end applications

IOT Enablement tools and technologies

Security implications of a large attack surface

Mentor Graphics Corp. Company Confidential

Complex communication fabric

Re-used design blocks 2002

Large memories 1999

2010 Mentor Graphics Corp. Company Confidential

We are running out of ideas on what else to put on the chip,

Since 2005 we found many more features that are needed

1970 1980 1990 2000 2010 2020

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

Mentor Graphics Corp. Company Confidential

Everyday objects have to be re-designed to include computers

Standalone Garage Door Opener becomes smart by connecting to your smart

2010 Mentor Graphics Corp. Company Confidential

Definition of embedded system is

Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

Humans are still part of the picture

2010 Mentor Graphics Corp. Company Confidential

Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

Mentor Graphics Corp. Company Confidential

Platform as a Service Managed IoT Platform

Solution as a Service Turnkey End-to-End Managed Solution

ADMIN SOLUTION CLOUD ON-PREMISE DEVICE

2010 Mentor Graphics Corp. Company Confidential

Freescale i.MX 6 Quad Cortex A9 processor

2010 Mentor Graphics Corp. Company Confidential

Managed REST Services APIs MANAGED DEVICE SERVICES

Cloud Vendor APIs

2010 Mentor Graphics Corp. Company Confidential

Mentor Graphics Corp. Company Confidential

Mentor Graphics Corp. Company Confidential

Social Engineering User 1 - 100

Malware / Macros Application 10,000 100,000

Viruses/ Trojans Operating System ~100 Million

2010 Mentor Graphics Corp. Company Confidential

2010 Mentor Graphics Corp. Company Confidential

Mentor Graphics Corp. Company Confidential

EDPS 2016 Keynote - S. Leef - April 2016

Stuxnet, a 500-kilobyte computer worm that infected

IEEE, The Real Story of Stuxnet, February 26, 2013

2010 Mentor Graphics Corp. Company Confidential

U.S. Department of Homeland Security Test

2010 Mentor Graphics Corp. Company Confidential

Malicious Logic inside Chip - (TROJANS)

Counterfeit Chips - (SUPPLY CHAIN ATTACKS)

2010 Mentor Graphics Corp. Company Confidential

To crack safes, its essential to know how they work

2010 Mentor Graphics Corp. Company Confidential

Subsequently, different power dissipation patterns can be observed

Incorporate randomness into